AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

HashiCorpCVE-2026-14869

HashiCorp Tooling: server-side request forgery

HashiCorp

CVE-2026-14869 · Published Jul 28, 2026 · updated Jul 30, 2026

High8.6
Fix: upgrade to 1.1.0 or later
HashiCorp advisory

The terraform-mcp-server before version 1.1.0 is vulnerable to a server-side request forgery issue in the streamable-HTTP transport that may allow an unauthenticated remote client to redirect the server's Terraform API requests, and the server-side authorization token, to an attacker-controlled endpoint. This vulnerability, CVE-2026-14869, is fixed in terraform-mcp-server 1.1.0.

Affected versions

PackageAffectedFixed in
Tooling
Product
>= 0.3.0, < 1.1.01.1.0
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-918

More HashiCorp advisories

All HashiCorp
Medium 5.3Aug 7HashiCorp Consul: denial of serviceCVE-2026-19113fixed in 2.0.3 +1Medium 4.2Aug 7Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are...CVE-2026-15970fixed in 2.0.3 +1High 8.6Jul 29HashiCorp Tooling: server-side request forgeryCVE-2026-16328fixed in 0.1.4Critical 10.0Jul 29In consul-mcp-serverCVE-2026-16326fixed in 0.1.4Critical 10.0Jul 28The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant...CVE-2026-16498fixed in 1.1.0High 8.9Jul 28HashiCorp Tooling: session fixationCVE-2026-16496fixed in 1.1.0